Re: [OE-core] [PATCH v2 1/2] uboot-sign: sign SPL FIT configurations instead of images

["Mathieu Dubois-Briand" <mathieu.dubois-briand@bootlin.com>]

On Tue May 26, 2026 at 11:40 AM CEST, Marta Rybczynska via lists.openembedded.org wrote:
> From: Marta Rybczynska <rybczynska@gmail.com>
>
> The SPL FIT signing path was signing individual images, but not the configuration.
>
> Introduce signing of configuration with images under a separate option SPL_SIGN_CONF,
> enabled by default. It implies changes in the DTB content.
>
> The old behaviour is possible with SPL_SIGN_INDIVIDUAL, but should be removed in
> a subsequent patch.
>
> Signed-off-by: Marta Rybczynska <rybczynska@gmail.com>

Hi Marta,

Thanks for the new version. I believe we still have two selftest
failures because of it:

2026-05-26 16:34:33,908 - oe-selftest - INFO - fitimage.UBootFitImageTests.test_sign_standalone_uboot_atf_tee_fit_image (subunit.RemotedTestCase)
2026-05-26 16:34:33,909 - oe-selftest - INFO -  ... FAIL
...
ERROR: u-boot-1_2026.04-r0 do_uboot_assemble_fitimage: Execution of '/srv/pokybuild/yocto-worker/oe-selftest-armhost/build/build-st-2700759/tmp/work/qemuarm-poky-linux-gnueabi/u-boot/2026.04/temp/run.do_uboot_assemble_fitimage.3572291' failed with exit code 1
...
| Signature written to 'u-boot-fitImage', node '/configurations/conf/signature'
| Public key written to 'spl/u-boot-spl.dtb', node '/signature/key-spl-oe-selftest'
| Signature check bad (error 1)
| Verifying Hash Integrity for node 'conf'... sha256,rsa2048:spl-oe-selftest+
| sha256,rsa2048:spl-oe-selftest-
|  error!
| Verification failed for '(null)' hash node in 'conf' config node
| Failed to verify required signature 'key-spl-cascaded-oe-selftest'
| WARNING: exit code 1 from a shell command.
...
2026-05-26 16:35:33,469 - oe-selftest - INFO - fitimage.UBootFitImageTests.test_sign_standalone_uboot_fit_image (subunit.RemotedTestCase)
2026-05-26 16:35:33,469 - oe-selftest - INFO -  ... FAIL
...
ERROR: u-boot-1_2026.04-r0 do_uboot_assemble_fitimage: Execution of '/srv/pokybuild/yocto-worker/oe-selftest-armhost/build/build-st-2700759/tmp/work/qemuarm-poky-linux-gnueabi/u-boot/2026.04/temp/run.do_uboot_assemble_fitimage.3689059' failed with exit code 1
...
| Signature written to 'u-boot-fitImage', node '/configurations/conf/signature'
| Public key written to 'spl/u-boot-spl.dtb', node '/signature/key-spl-oe-selftest'
| Signature check bad (error 1)
| Verifying Hash Integrity for node 'conf'... sha256,rsa2048:spl-oe-selftest+
| sha256,rsa2048:spl-oe-selftest-
|  error!
| Verification failed for '(null)' hash node in 'conf' config node
| Failed to verify required signature 'key-spl-cascaded-oe-selftest'
| WARNING: exit code 1 from a shell command.

https://autobuilder.yoctoproject.org/valkyrie/#/builders/23/builds/3999
https://autobuilder.yoctoproject.org/valkyrie/#/builders/35/builds/3905
https://autobuilder.yoctoproject.org/valkyrie/#/builders/48/builds/3770

Can you have a look at the issue?

Thanks,
Mathieu

-- 
Mathieu Dubois-Briand, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com